Sensitive Information disclosed via Application Status 400 Error

Issue

• Application Server errors at times may identify software, software versioning and hint at how user input is processed.
  This sample trace to demonstrate was triggered by having invalid characters (namely a set of square brackets '[ ]' ) in a given URL. Tomcat considers the address as malformed.
  
  

  HTTP Status 400 – Bad Request
  Type Exception Report
  Message Invalid character found in the request target. The valid characters are defined in RFC 7230 and RFC 3986
  Description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).
  Exceptionjava.lang.IllegalArgumentException: Invalid character found in the request target. The valid characters are defined in RFC 7230 and RFC 3986
  	org.apache.coyote.http11.Http11InputBuffer.parseRequestLine ....
  	org.apache.coyote.http11.Http11Processor.service ....
  	org.apache.coyote.AbstractProcessorLight.process ....
  	org.apache.coyote.AbstractProtocol$ConnectionHandler.process ....
  	org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun ....
  	org.apache.tomcat.util.net.SocketProcessorBase.run ....
  	java.util.concurrent.ThreadPoolExecutor.runWorker ....
  	java.util.concurrent.ThreadPoolExecutor$Worker.run ....
  	org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run ....
  	java.lang.Thread.run ....
  Note The full stack trace of the root cause is available in the server logs.

Environment

• [General Information]
  Application Servers in use with DXP 7.0   DXP 7.1   DXP 7.2    DXP 7.3

Resolution

• Remove any invalid characters from the resource address which generate the error.
  
  
• Consider redirecting 400 status errors to a custom error page.
  This guide offers some references on how it may be achieved:
  https://stackoverflow.com/questions/52814582/tomcat-is-not-redirecting-to-400-bad-request-custom-error-page/55702749#55702749
  
  

Additional Information

• Reference link to RFC 7230
• Reference link to RFC 3986